Auth0: offline_access breaks jwt decryption

[maximevast]

Hello 👋

I'm trying to implement next-auth with Auth0 provider to an existing application.
Everything works fine, but when I try to add the offline_access scope to retrieve a refresh token, the application randomly crashes after a few seconds:

https://next-auth.js.org/warnings#no_secret
[next-auth][error][JWT_SESSION_ERROR]
https://next-auth.js.org/errors#jwt_session_error decryption operation failed {
  message: 'decryption operation failed',
  stack: 'JWEDecryptionFailed: decryption operation failed\n' +
    '    at gcmDecrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:67:15)\n' +
    '    at decrypt (my_path/node_modules/jose/dist/node/cjs/runtime/decrypt.js:92:20)\n' +
    '    at flattenedDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/flattened/decrypt.js:119:52)\n' +
    '    at runMicrotasks (<anonymous>)\n' +
    '    at processTicksAndRejections (internal/process/task_queues.js:95:5)\n' +
    '    at async compactDecrypt (my_path/node_modules/jose/dist/node/cjs/jwe/compact/decrypt.js:18:23)\n' +
    '    at async jwtDecrypt (my_path/node_modules/jose/dist/node/cjs/jwt/decrypt.js:8:23)\n' +
    '    at async Object.decode (my_path/node_modules/next-auth/jwt/index.js:62:7)\n' +
    '    at async Object.session (my_path/node_modules/next-auth/core/routes/session.js:41:28)\n' +
    '    at async NextAuthHandler (my_path/node_modules/next-auth/core/index.js:96:27)\n' +
    '    at async NextAuthNextHandler (my_path/node_modules/next-auth/next/index.js:20:19)\n' +
    '    at async my_path/node_modules/next-auth/next/index.js:56:32\n' +
    '    at async apiResolver (my_path/node_modules/next/dist/next-server/server/api-utils.js:8:1)\n' +
    '    at async DevServer.handleApiRequest (my_path/node_modules/next/dist/next-server/server/next-server.js:64:462)\n' +
    '    at async Object.fn (my_path/node_modules/next/dist/next-server/server/next-server.js:56:492)\n' +
    '    at async Router.execute (my_path/node_modules/next/dist/next-server/server/router.js:23:67)',
  name: 'JWEDecryptionFailed'
}

I'm not even trying to do anything with the refresh token at the moment, just changing the scopes.
When reverting to the default scopes everything works fine again.

Here's my code:

export default NextAuth({
// Configure one or more authentication providers
providers: [
  Auth0Provider({
    clientId: CLIENT_ID,
    clientSecret: CLIENT_SECRET,
    issuer: ISSUER,
    idToken: true,
    // authorization: {params: {scope: 'openid email profile offline_access'}},
  }),
],
callbacks: {
  async signIn({profile}) {
    // Sentry.setUser(...)
    return true
  },
  async redirect({baseUrl}) {
    return baseUrl
  },
  async jwt({token, account, profile}) {
    if (account) {
      token.accessToken = account.id_token
    }
    if (profile) {
      token.profile = profile['https://my-company-oauth-profile-path/']
    }

    return token
  },
  async session({session, token}) {
    session.accessToken = token.accessToken
    session.profile = token.profile
    return session
  },
},
pages: {
  signIn: '/auth/signin',
},
debug: true,

})

My next-auth version is "4.1.2".

Many thanks for your help

[balazsorban44]

https://next-auth.js.org/configuration/options#secret

[maximevast]

That fixed it! I wasn't looking into this warning as I thought it was only required for production environment.

Köszönöm !

[balazsorban44]

Szívesen! 🇭🇺